f42a5d02a5131c2c24b4b82ebc02f8d752b745f279b63bba6a24411a5ef0a884

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 12:51

Target

Stix Free Utility V1.0.0.exe
Size

4.2MB
MD5

c0824328e8218c78fde712b11154d514
SHA1

c733ab51483097d286b8afc295627b11aa67ce52
SHA256

f42a5d02a5131c2c24b4b82ebc02f8d752b745f279b63bba6a24411a5ef0a884
SHA512

f625e2599d62396f61b89aa86b250a76715ee5719e0534da8400e8f9e2ba0d04873eaea7bdc55462029f02297e2c42450837d98e93d4bac9f522c7e4f3f04d83
SSDEEP

24576:waKe+2qSUfwqHi4kZmR8MMjUt51PVhD4QX0ifuIa3slKyJaL+pDcbICY:wNYq25Ut3LXVKyJ6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2972	1792	Stix Free Utility V1.0.0.exe	30
PID 1792 wrote to memory of 2972	1792	Stix Free Utility V1.0.0.exe	30
PID 1792 wrote to memory of 2972	1792	Stix Free Utility V1.0.0.exe	30

C:\Users\Admin\AppData\Local\Temp\Stix Free Utility V1.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\Stix Free Utility V1.0.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1792 -s 536
  2⤵
  PID:2972

memory/1792-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/1792-1-0x0000000000130000-0x0000000000576000-memory.dmp

Filesize
4.3MB

Download
memory/1792-2-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download